{"id":"CVE-2026-108049","kind":"vulnerability","aliases":["CVE-2026-108049"],"related":[],"title":"Alosuite login page can be framed for clickjacking attacks","description":"Clickjacking vulnerability in the Alosuite web application. The affected login interface can be embedded in a web page controlled by an attacker because it does not implement adequate user interface protection mechanisms, such as the X-Frame-Options header or an appropriate Content-Security-Policy (frame-ancestors) directive. By tricking a victim into interacting with a malicious web page, an attacker can trigger unwanted actions within the Alosuite application embedded in the frame, which could compromise the integrity of user interactions and facilitate further attacks against authenticated users.","summary":"The Alosuite web application's login interface can be embedded in an attacker's page because it lacks X-Frame-Options or a frame-ancestors policy. A victim tricked into clicking the malicious page can have unwanted actions performed inside the hidden Alosuite frame.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["alosuite","other","web-app"],"not_affected_if":["headers-already-set","no-browser-access"],"how_to_check":"- Request the Alosuite login page and check the response headers for `X-Frame-Options` or a `Content-Security-Policy` containing `frame-ancestors`\n- Confirm which Alosuite version is deployed; the sources do not name affected versions","fix":null,"status":"open","published_at":"2026-11-03T13:17:17+00:00","first_seen_at":"2026-11-03T13:20:52+00:00","triaged_at":"2026-11-03T13:21:47+00:00","updated_at":"2026-11-03T13:21:47+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T13:21:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Alosuite login page can be framed for clickjacking attacks","impact":"medium","summary":"The Alosuite web application's login interface can be embedded in an attacker's page because it lacks X-Frame-Options or a frame-ancestors policy. A victim tricked into clicking the malicious page can have unwanted actions performed inside the hidden Alosuite frame.","audience":"businesses","category":"other","nicknames":[],"who_cares":["alosuite","web-app"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"victim clicks hidden buttons and triggers unwanted application actions","analyst_note":"Confirm affected Alosuite versions and the vendor fix from the NVD entry or the vendor advisory, since the sources give no version or fix.","how_to_check":"- Request the Alosuite login page and check the response headers for `X-Frame-Options` or a `Content-Security-Policy` containing `frame-ancestors`\n- Confirm which Alosuite version is deployed; the sources do not name affected versions","plain_action":"","needs_analyst":true,"not_affected_if":["no-browser-access","headers-already-set"],"who_is_affected":"Organizations that run the Alosuite web application and let users sign in through its browser interface. The sources do not name affected versions or deployment modes. Teams that do not expose Alosuite to users in a browser are unlikely to be affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00069,"input_tokens":4190,"output_tokens":541,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108049':12A,15A '-2026':11A,14A 'action':60B,134C 'adequ':94C 'affect':75C 'alosuit':1A,16B,22B,65B,71C,137C 'ancestor':47B,116C 'app':20B 'applic':24B,73C,138C 'appropri':109C 'attack':9A,33B,88C,130C,154C 'authent':156C 'click':53B 'clickjack':8A,67C 'compromis':145C 'content':111C 'content-security-polici':110C 'control':85C 'could':144C 'cve':10A,13A 'direct':117C 'embed':30B,80C,139C 'facilit':152C 'frame':6A,41B,46B,66B,104C,115C,142C 'frame-ancestor':45B,114C 'header':106C 'hidden':64B 'implement':93C 'insid':62B 'integr':147C 'interact':123C,150C 'interfac':27B,77C,96C 'lack':38B 'login':2A,26B,76C 'malici':55B,126C 'mechan':98C 'option':42B,105C 'page':3A,35B,56B,84C,128C 'perform':61B 'polici':48B,113C 'protect':97C 'secur':112C 'trick':51B,119C 'trigger':132C 'unwant':59B,133C 'user':95C,149C,157C 'victim':50B,121C 'vulner':68C 'web':19B,23B,72C,83C,127C 'web-app':18B 'within':135C 'x':40B,103C 'x-frame-opt':39B,102C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run the Alosuite web application and let users sign in through its browser interface. The sources do not name affected versions or deployment modes. Teams that do not expose Alosuite to users in a browser are unlikely to be affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["alosuite","medium","other","webapp"],"first_public_at":"2026-11-03T13:17:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108049","severity":null,"published_at":"2026-11-03T13:17:17+00:00","modified_at":"2026-11-03T13:17:17+00:00","first_seen_at":"2026-11-03T13:20:52+00:00","fetched_at":"2026-11-03T13:20:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}